It's not just a small world; it's an easily tracked one. Later this year, Disney is planning to introduce RFID-enabled "MagicBands" at its amusement parks, onto which visitors can upload their personal information, including credit card details, in order to navigate the parks as easily as Peter Pan does the Land of Lost Boys. After a New York Times article that spelled out how the bands will allow Disney to make the theme park experience easier and more personalized for its millions of visitors while also allowing Disney to "track guest behavior in minute detail," Congressman Ed Markey wondered whether Mickey Mouse was getting a little too creepy.

“Although kids should have the chance to meet Mickey Mouse, this memorable meeting should not be manipulated through surreptitious use of a child’s personal information," wrote Markey in a press release last week that accompanied a letter [PDF] to the company expressing concerns about Disney tracking kids' movements and preferences and targeting them with ads. Markey, who has spearheaded a movement to protect kids' privacy online, asked Disney to answer questions about the offline tracking of kids at the Magic Kingdom and asked for an answer by Valentine's Day. Disney was not happy to be addressed as if it were Ursula, Cruella, or one of the many evil stepmothers and to have their "MagicBand" portrayed as nefarious by a national lawmaker. Disney's CEO Robert Iger pulled no punches in an angry response.

Disney's Bob Iger

"We are offended by the ludicrous and utterly ill-informed assertion in your letter dated January 24, 2013, that we would in any way haphazardly or recklessly introduce a program that manipulates children, or wantonly puts their safety at risk," wrote Iger, in a letter posted in full on Inside The Magic (Yeah, that's an actual blog all about Disney). "It is truly unfortunate and extremely disappointing that you chose to publicly attack us before taking the time to review our policies and/or contact us for information, which would have obviated the need for your letter."

A Disney spokesperson says the company found out about the letter through the press before they actually received it, after the letter was posted to Markey's website on Thursday evening.

"The 'MagicBand' program hasn't even launched yet," says a spokesperson. "We don't have a problem answering questions, but all of these were already addressed in publicly available materials."

In its response to Markey, Disney says it doesn't plan to use information from the bands to market to children under age 13 and will only collect information about wee guests with the explicit permission of their parents. As to whether information from the bands will be shared with the rest of the Disney empire, Disney says that will only be done with the explicit consent of their guests (Read those terms and conditions carefully, Mickey-lovers!).

I've seen a lot of privacy-indignant letters fly out of Congress to companies, but this is one of the first truly-angry (public) responses I've seen. That's likely because Disney's brand relies heavily on being a trusted entertainer of children. It's not the first time they've had to deal with issues around children's privacy. In 2011, the company paid a $3 million fine because an online gaming company it acquired, Playdom, had collected information from children without their parents' consent.

"Shoot first and ask questions later has become the unfortunate pattern on Capitol Hill when privacy questions arise," says Jules Polonetsky of the Future of Privacy Forum. "Companies are assumed to be up to no good, even when their goal is using technology to improve services for consumers. If these MagicBands save Disney-goers time waiting on line, they will be as big a hit as Mickey Mouse."

Meanwhile, Disney takes pains to point out that the bands are not forced on their guests, and that they decide how much information they share. A Disney spokesperson says that the New York Times article -- which imagined Disney princesses greeting visitors by name -- was envisioning a much more technologically advanced version of the bands than will exist any time soon.

"MyMagic+ is a completely optional program that was designed with privacy controls from the outset," writes Iger.